Protecting Your Data Online: A Practical Checklist
You cannot be invisible, but you can be a much harder target. The steps below are ordered by how much they actually reduce your risk.
Most account takeovers do not involve clever hacking. They involve a password reused from a site that leaked years ago, tried automatically against your email.
That single fact should reorder your priorities. A password manager and unique passwords do more for your security than almost anything else you can do in an afternoon.
The highest-value steps
- Use a password manager and let it generate every password. You only need to remember one strong passphrase.
- Turn on two-factor authentication, ideally with an app rather than SMS. SMS codes can be intercepted by swapping your SIM.
- Secure your email first. Email resets everything else, so it deserves the strongest protection you have.
- Update your devices. Most attacks exploit flaws that were patched months earlier.
The steps that feel good but matter less
Deleting social media accounts and using a VPN are popular and rarely the thing that saves you. They help at the margins and are worth doing after the basics.
The same goes for exotic browsers and encrypted messaging. Good tools. Not the first move.
Living with the tradeoff
Perfect privacy costs convenience, and most people abandon a setup that is too annoying to maintain. A realistic goal is to be harder to attack than the average person, sustainably.
Review once a year. Remove accounts you no longer use, confirm two-factor is still on, and update your recovery information. That annual hour is worth more than any single product you could buy.
The bottom line
Unique passwords, two-factor on your email, and updated devices cover most of the risk. Everything else is refinement, and none of it helps if the basics are missing.
